ThinkPad T480 fingerprint reader on Fedora Linux

t480-fedora-fingerprint.md

ThinkPad T480 fingerprint reader on Fedora Linux

Background

The Synaptics fingerprint sensor (06cb:009a) present on my T480 is not supported by libfprint and fprintd as it requires a non-free binary blob. uunicorn created open-fprintd, a replacement for fprintd, that allows for loading of binary blobs. In conjunction with their python-validity driver we are able to make use of the inbuilt fingerprint reader. The following instructions were tested against Fedora Linux 35.

Installing open-fprintd and python-validity

sudo dnf copr enable tigro/python-validity
sudo dnf install open-fprintd fprintd-clients fprintd-clients-pam python3-validity

Prepare the fingerprint reader

sudo touch /usr/share/python-validity/backoff
sudo touch /usr/share/python-validity/calib-data.bin
sudo validity-sensors-firmware
sudo python3 /usr/share/python-validity/playground/factory-reset.py
sudo chmod 0755 /usr/share/python-validity/6_07f_lenovo_mis_qm.xpfwext

Enable services

sudo systemctl enable python3-validity open-fprintd-resume open-fprintd-suspend
sudo systemctl start python3-validity

Enroll and test fingerprint

fprintd-enroll
fprintd-verify

Enable authentication with fingerprint

sudo authselect current
sudo authselect enable-feature with-fingerprint
sudo authselect apply-changes

There's a typo in the first line of the Enable services section:

It should be: sudo systemctl enable python3-validity open-fprintd-resume open-fprintd-suspend

Nice catch, thank you!

there's a driver for 009a which allows fprintd usage. https://gitlab.com/bingch/libfprint-tod-vfs0090/

Worked on T470s, thank you so much

I might add that if you are getting a DBUS Error, you need to set SELinux to Permissive.
sudo setenforce Permissive

(This is from uunicorn/python-validity#89 (comment))

Also, I am having issues with the fingerprint scanner not activating (or the fingerprint service) after a suspend on fedora 36, this is especially annoying in the terminal as I have to wait for the fingerprint prompt to timeout and type my password. I think there is an issue open for this but if anyone has a solution please share it!

EDIT: Apparently someone made a systemctl service as a workaround to this issue, I did not try it though:
uunicorn/python-validity#106 (comment)

Thanks for all this. Got it working on my ThinkPad T480s with Debian Sid + KDE.

I'm wondering if anyone has advice on speeding up the whole authentication process. Using either password or fingerprint there's about a 3-5 second delay before I'm able to unlock anything.

Additionally coming back from sleep it seems like python3-validity becomes unresponsive. I've added in a restart of the service to a post wakeup script.

Glad to hear it's helpful 🙂

Additionally coming back from sleep it seems like python3-validity becomes unresponsive.

Interesting, I had not encountered this on Fedora. What sleep state are you entering?

cat /sys/power/mem_sleep
s2idle [deep]

Also s2idle [deep].

Thanks for this! Worked on my T480S

@Carlos-RD: Do you also see a delay in log-in, either with fingerprint or text password when fingerprint is turned on?

@Carlos-RD: Do you also see a delay in log-in, either with fingerprint or text password when fingerprint is turned on?

I do see the delay and not coming back from suspend. Both in Fedora 37, T480.

Thanks for the work!!!

So a little update. I need to periodically restart both open-fprintd and python3-validity, and it needs to happen in that exact order. I'm on Debian, so you might need to adapt this to your own distro's way of doing things.

To my system's crontab I've added this to restart both services once an hour on the hour:

0 0 *   * * *   root    service open-fprintd restart ; service python3-validity restart

And I created the script /usr/lib/systemd/system-sleep/fprint_wakeup to run after a wakeup from suspend:

#!/bin/bash
# 
# Restarting fingerprint reader related services on wakeup
# https://gist.github.com/borcean/f32c47f6cc52cee33dfc2265ce63f777
#
# located in /usr/lib/systemd/system-sleep/

exec 2> /tmp/systemd_fprint_wakeup_err.txt
if [ "${1}" = "pre" ]; then
  # Do the thing you want before suspend here
  echo "we are suspending." > /tmp/systemd_fprint_wakeup_err.txt
elif [ "${1}" = "post" ]; then
  # Do the thing you want after resume here
        service open-fprintd restart
        service python3-validity restart
  echo "and we are back from being suspended" >> /tmp/systemd_fprint_wakeup_err.txt
fi

Make that script executable:

sudo chmod +x /usr/lib/systemd/system-sleep/fprint_wakeup

I'm sure there's a better way to do both of these things, if anyone suggests something better I'm all ears. Since implementing these two things I haven't hit any snags. What also helped was realizing my right index finger just doesn't have a fingerprint anymore. I still see there being a longer than expected delay before PAM does all of the right things, either with reading my fingerprint or typing in a text password.

After trying to enroll I get a message "Impossible to enroll: GDBus.Error:net.reactivated.Fprint.Error.NoSuchDevice:"
Any ideas to point me in the right direction? I'm on Fedora 38 with a T480.

Thanks

Tested Rubin's solution to the sleep problem on Fedora 38 and it works wonderfully! Thanks for the great work!

Follow this comment for t480s and fedora 38 GDBUS.Error

sudo setenforce Permissive
sudo systemctl restart python3-validity

#for auth in terminal
sudo authselect enable-feature with-fingerprint

Might be obvious for some, but: don't forget to restart after executing this gist!

anyone know if this is still working in fedora 39? I tried some things last year I couldnt get to work but dont recall trying a guide that dipped into selinux modification

PS: this is partially working for me but when waking from sleep I cant use fingerprint and there is a long delay after using password before it lets me in